masslogger

General

Target

595a0e25fbeb1ee5f3cb649639fd345e0cd0b777a51ff60562151ffc07aa5de9
Size

820KB
Sample

220414-q27b4abcal
MD5

666812baf8e775a44dc4b05c5b26c00b
SHA1

02c46ff04b7e4fad87eb9971fc6b54116230449e
SHA256

595a0e25fbeb1ee5f3cb649639fd345e0cd0b777a51ff60562151ffc07aa5de9
SHA512

9520cacffd21c48def31e1a71579426d5d6b7ed9182b1ae02a5a6a8d5248fa7cdb17ef8385e2bbc71ce524653d419a39cef5ceb6e91733c095ff8374a79c9c58

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/14/2022 5:12:22 PM MassLogger Started: 4/14/2022 5:12:06 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\FYI.img.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\2ABA732E76\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/14/2022 3:09:38 PM MassLogger Started: 4/14/2022 3:09:35 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\FYI.img.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
smtp.lifechangingresult.com
Port:
587
Username:
[email protected]
Password:
*JYcMtXp2

Targets

- Target
  
  FYI.img.exe
- Size
  
  969KB
- MD5
  
  e7640dd70bded3e34b63fbca499e4235
- SHA1
  
  aecd69824a9d00aa6c2ea77660a5d7b53f86d42c
- SHA256
  
  1f11c6facb44592d24f7479b96b782901feb7b7a320000230740c40b67deb3a1
- SHA512
  
  046b384e0c83cdf360a2ae340359e6aae5981260a44415bb9d3c1526f72ae9a5de4ade4cc7e99d2110d7c5750c40e76cc48d575ed262f686a174576caecf51b4
Score

10^/10

masslogger coreentity ransomware rezer0 spyware stealer collection
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2